from __future__ import annotations

import base64
import hashlib
import hmac

from cryptography.fernet import Fernet
from django.conf import settings


_FERNET_PREFIX = b"v2:"


def _derive_fernet_key() -> bytes:
    secret = settings.SECRET_KEY.encode()
    key_material = hashlib.sha256(secret + b"hr-fernet-v2").digest()
    return base64.urlsafe_b64encode(key_material)


def encrypt_field(plaintext: str) -> str:
    if not plaintext:
        return ""
    fernet = Fernet(_derive_fernet_key())
    token = fernet.encrypt(plaintext.encode())
    return (_FERNET_PREFIX + token).decode()


def decrypt_field(ciphertext: str) -> str:
    if not ciphertext:
        return ""
    if ciphertext.startswith("v2:"):
        fernet = Fernet(_derive_fernet_key())
        try:
            return fernet.decrypt(ciphertext[3:].encode()).decode()
        except Exception:
            return ""
    return _decrypt_v1_xor(ciphertext)


def _decrypt_v1_xor(ciphertext: str) -> str:
    """Decrypt data encrypted with the v1 XOR-stream cipher."""
    try:
        raw = bytes.fromhex(ciphertext)
    except ValueError:
        return ciphertext
    if len(raw) < 16:
        return ciphertext
    iv, pad = raw[:16], raw[16:]
    key = _derive_v1_xor_key()
    stream = hashlib.sha256(key + iv).digest()
    return bytes(
        stream[i % len(stream)] ^ pad[i] for i in range(len(pad))
    ).decode(errors="replace")


def _derive_v1_xor_key() -> bytes:
    secret = settings.SECRET_KEY.encode()
    return hmac.new(secret, b"hr-sensitive-field-v1", hashlib.sha256).digest()